Washington A.G. Ferguson’s Investigation Into Premera Data Breach Results in Premera Paying $10 Million Over Failure to Protect Sensitive Patient Data
* * *
- Premera will pay
* * *
As a result of an
The data breach affected the information of more than 10.4 million individuals nationwide, including more than 6.4 million Washingtonians. Under the consent decree, filed today in
Premera's
The consent decree also legally requires Premera to implement specific data security controls to protect personal health information, annually review its security practices and provide data security reports to the
"Premera had an obligation to safeguard the privacy of millions of Washingtonians -- and failed," Ferguson said. "As a result, millions had their sensitive information exposed. Premera repeatedly ignored both its own employees and cybersecurity experts who warned millions of consumers' sensitive health information was at risk."
In today's complaint, Ferguson asserts that the company failed to meet its obligations under the federal Health Insurance Portability and Accountability Act (HIPAA) and violated the
From
The hacker took advantage of multiple known weaknesses in Premera's data security. For years prior to the breach, cybersecurity experts and the company's own auditors repeatedly warned Premera of its inadequate security program, yet the company accepted many of the risks without fixing its practices.
Ferguson's complaint asserts that Premera misled Washingtonians and other consumers nationwide about its privacy practices before and after the data breach. In privacy notices, Premera told its members, "We take steps to secure our buildings and electronic systems from unauthorized access."
After the breach became public, Premera's call center agents told consumers there was "no reason to believe that any of your information was accessed or misused." They also told consumers that "there were already significant security measures in place to protect your information," even though multiple security experts and auditors warned the company of its security vulnerabilities prior to the breach.
Under HIPAA, Premera is required to implement administrative, physical and technical safeguards that reasonably and appropriately protect sensitive consumer information. Premera repeatedly failed to meet these standards, leaving millions of consumer's sensitive data vulnerable to hackers for nearly a year.
Today's consent decree also requires Premera to:
* Ensure its data security program protects personal health information as required by law
* Regularly assess and update its security measures
* Map where HIPAA-protected information, including personal health information, is located on the Premera network
* Provide data security reports, completed by a third-party security expert approved by the multistate coalition, to the
* Hire a chief information security officer, a separate position from the chief information officer. The information security officer must be experienced in data security and HIPAA compliance and will be responsible for implementing, maintaining and monitoring the company's security program.
* Hold regular meetings between the chief information security officer and Premera's executive management. The information security officer must meet with Premera's CEO every two months and inform the CEO of any unauthorized intrusion into the Premera network within 48 hours of discovery.
* Create a compliance program and hire a compliance officer with a background in HIPAA compliance
* Map where HIPAA-protected information, including personal health information, is located on the Premera network
* Provide security training to all employees who handle personal information and protected health information
The proposed class action settlement provides for additional relief for affected individuals. Consumers affected by Premera's conduct should expect to receive information about restitution after the settlement is approved by the court. More information about the class action is available here.
Assistant Attorneys General
Insurance Information Institute Offers Guidance to Texans, Louisianans As Tropical Storm Barry Approaches
Louisiana Gov. Edwards Request Federal Emergency Declaration in Advance of Tropical Storm Barry
Advisor News
- The ‘sandwich generation’ faces compounded barriers to retirement savings
- Benefit Costs Squeeze Schools, Driving Cuts, Tax Hikes And Difficult Tradeoffs
- Why client insurance needs could change even if their life doesn’t
- Most Gen Z investors think less than a year ahead when making financial decisions
- IRI pitches retirement agenda to Jeffries as democrats shape affordability platform
More Advisor NewsAnnuity News
- The next phase of life insurance investing
- Ty J. Young Wealth Management Acquires Senior Insurance Services, Expanding Its Growing Annuity Firm: Ty J. Young Wealth Management
- Guidance, bulletin or reg? NAIC debates form of annuity illustration update
- Nationwide adds mutual fund-linked strategy to New Heights Select FIA
- NUNN INTRODUCES BILL TO CUT RED TAPE, GIVE IOWANS CLEARER INSURANCE INFORMATION
More Annuity NewsHealth/Employee Benefits News
Life Insurance News